Model Extraction Attacks 
Model extraction attacks target the confidentiality of ML models and aim to imitate the function of a black-box victim model [1]}, [2]}, [3]}. First, adversaries collect or synthesize an initially unlabeled substitute dataset. Next, they exploit the ability to query the victim model APIs for label predictions to annotate the substitute dataset. Then, they can train a high-performance model utilizing the pseudo-labeled dataset. Recently, several works [4]}, [5]}, [6]} attempt to address the model extraction attacks on NLP models, e.g. BERT [7]} or Google Translate.
